Cisco 7604 Configuration Manual page 532

Understanding How DoS Protection Works
Burst values regulate how many packets can be allowed in a burst. Each allowed packet consumes a token
and a token must be available for a packet to be allowed. One token is generated per millisecond. When
packets are not coming in, tokens can be accumulated up to the burst value. For example, if the burst
value is set to 50, the router can accumulate up to 50 tokens and absorb a burst of 50 packets.
This example shows how to rate limit the unicast packets from an ingress ACL bridge result to 50000
packets per second, and 50 packets in burst:
Router(config)# mls rate-limit unicast acl input 50000 50
This example shows how to rate limit the unicast packets from an ingress ACL bridge result to the same
rate (50000 pps and 50 packets in burst) for egress ACL bridge results:
Router(config)# mls rate-limit unicast acl output 50000 50
If the values of the rate limiter are altered on either the ingress or the egress when both are enabled, both
values are changed to that new value. In the following example, the output rate is changed to 40000 pps:
Router(config)# mls rate-limit unicast acl output 40000 50
When you enter the show mls rate-limit command, both the ACL bridged in and the ACL bridged out
display the new value of 40000 pps:
Router# show mls rate-limit
Rate Limiter Type
---------------------
MCAST NON RPF
MCAST DFLT ADJ
MCAST DIRECT CON
ACL BRIDGED IN
ACL BRIDGED OUT
IP FEATURES
...
uRPF Check Failure
The uRPF check failure rate limiter allows you to configure a rate for the packets that need to be sent to
the MSFC because they failed the uRPF check. The uRPF checks validate that incoming packets on an
interface are from a valid source, which minimizes the potential threat of DoS attacks from users using
spoofed addresses. When spoofed packets fail the uRPF check, those failures can be sent to the MSFC.
The uRPF check rate limiters allow you to rate limit the packets per second that are bridged to the MSFC
CPU when a uRPF check failure occurs.
This example shows how to rate limit the uRPF check failure packets sent to the MSFC to 100000 pps
with a burst of 100 packets:
Router(config)# mls rate-limit unicast ip rpf-failure 100000 100
TTL Failure
This rate limiter rate limits packets sent to the MSFC because of a time-to-live (TTL) check failure. As
indicated by the all keyword in the following example, this rate limiter applies to both multicast and
unicast traffic.
Note The TTL failure rate limiter is not supported for IPv6 multicast.
This example shows how to rate limit the TTL failures to 70000 pps with a burst of 150:
Router(config)# mls rate-limit all ttl-failure 70000 150
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
36-16
Status Packets/s
---------- ---------
Off -
On 100000
Off -
On 40000
On 40000
Off
Chapter 36 Configuring Denial of Service Protection
Burst
-----
-
100
-
50
50
OL-4266-08